hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-02-12 13:11:20 +01:00
Code Issues Packages Projects Releases Wiki Activity
85,654 Commits 1,689 Branches 160 Tags
codeql-cli/latest
Commit Graph

85654 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Jeroen Ketema
ccd07b8a63 C++: Simplify cpp/sql-injection barrier 
SQL sanitizers will not likely also be sources, so using `isBarrierIn` here
does not make a lot of sense.

I ran with and without this change on MRVA and got identical results.
 2026-01-23 09:03:48 +01:00
yoff
55abc52c61 python: format file 2026-01-22 20:51:46 +01:00
Simon Friis Vindum
e40f896b17 Merge pull request #21205 from paldepind/shared/ti-boound-tm 
Rust: Change `getATypeParameterConstraint` to not require a `TypeMention`
 2026-01-22 19:08:53 +01:00
yoff
d05901ad3f python/javascript/ruby: mark internal predicates 2026-01-22 17:30:24 +01:00
yoff
7f00a7f67e Update python/ql/lib/semmle/python/security/dataflow/UrlRedirectCustomizations.qll 
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>
 2026-01-22 17:30:24 +01:00
yoff
b08c972cc3 ruby: Add back sanitizer as MaD model 2026-01-22 17:30:24 +01:00
yoff
15980cb1da ruby: remove sanitizer to be replaced by MaD model 2026-01-22 17:30:24 +01:00
yoff
75bd4a7a12 javascript: add MaD model 
- consider if the model is in the right place
- consider if the barrier kind (sink kind) is the appropriate one
 2026-01-22 17:30:24 +01:00
yoff
da2f77d615 javascript: remove sanitizer to be replaced by model 2026-01-22 17:30:24 +01:00
yoff
3dbfb9fa4b python: add machinery for MaD barriers 
and reinstate previously removed barrier
now as a MaD row
 2026-01-22 17:30:24 +01:00
yoff
699ed50432 python: remove barrier that can be expressed in MaD 2026-01-22 17:30:24 +01:00
Geoffrey White
f484d95081 Merge remote-tracking branch 'upstream/main' into addsub 2026-01-22 16:03:42 +00:00
Simon Friis Vindum
ffaf1c0a24 Rust: Change getATypeParameterConstraint to not require a TypeMention 2026-01-22 14:54:24 +01:00
Tom Hvitved
201512525b Merge pull request #21203 from hvitved/ql4ql/use-nightly 
QL4QL: Use nightly CodeQL CLI
 2026-01-22 14:30:24 +01:00
Geoffrey White
b8581e89bf Rust: More affected tests. 2026-01-22 13:22:43 +00:00
Simon Friis Vindum
7d34f6e262 Merge pull request #21204 from paldepind/rust/assoc-tp-fix 
Rust: Remove mistakenly included inherited associated types
 2026-01-22 13:46:09 +01:00
Geoffrey White
67b52e29e0 Rust: Update other affected tests. 2026-01-22 12:29:21 +00:00
Geoffrey White
3d6765ba1c Rust: Clean up / fix some existing models. 2026-01-22 12:29:20 +00:00
Geoffrey White
fa9677d615 Rust: Add model variants for core::ops::bit on Wrapping. 2026-01-22 12:29:14 +00:00
Geoffrey White
9d645508ea Rust: Add model variants for core::ops:arith on Wrapping. 2026-01-22 10:46:15 +00:00
Simon Friis Vindum
114db99dca Rust: Remove mistakenly included inherited associated types 2026-01-22 11:44:26 +01:00
Tom Hvitved
8ce2618b7d Merge pull request #21151 from hvitved/rust/disable-universal-conds-by-default 
Type inference: Disable universal conditions by default
 2026-01-22 11:19:50 +01:00
Geoffrey White
e8ef58d381 Rust: Fix an issue with identifying sources and sinks in the test. 2026-01-22 09:58:58 +00:00
Geoffrey White
f8d0a0d509 Rust: Expand the Wrapping test some more. 2026-01-22 09:52:26 +00:00
Tom Hvitved
80d543ecae QL4QL: Use nightly CodeQL CLI 2026-01-22 10:14:05 +01:00
Tom Hvitved
65ca8849f2 Type inference: Disable universal conditions 2026-01-22 09:56:52 +01:00
Mathias Vorreiter Pedersen
73eb3e262d Merge pull request #21202 from MathiasVP/add-is-live-predicate-to-ssa-definition 
C++: Add `isLiveAtEndOfBlock` predicate to `Ssa::Definition`
 2026-01-21 22:50:46 +00:00
Mathias Vorreiter Pedersen
60ee92d834 C++: Drive-by fix: Don't use the uncached ''getAPhiInputOrPriorDefinition' predicate. Instead, cache it and call it like we are supposed to. 2026-01-21 20:28:28 +00:00
Mathias Vorreiter Pedersen
d89967ce8e C++: Add ''isLiveAtEndOfBlock' predicate to 'Definition'. 2026-01-21 20:27:39 +00:00
Mathias Vorreiter Pedersen
dd415386ea Merge pull request #21142 from MathiasVP/ir-support-for-assertions 
C++: Generate IR for assertions in release builds
 2026-01-21 19:32:24 +00:00
Mathias Vorreiter Pedersen
64a7d7d836 C++: Also output variable name in test. 2026-01-21 19:14:50 +00:00
Ian Lynagh
5e536fb121 C++: Rename holdsInBase to isBase 
Makes it consistent with isOverlay.
 2026-01-21 18:13:58 +00:00
Ian Lynagh
7bd62087a4 C++ overlay: Simplify QL 
Remove redundant variable names.
 2026-01-21 18:06:43 +00:00
Owen Mansel-Chan
656ebab776 Allow MaD barriers 
This commit was done by Opus 4.5 with the following prompt:

In the commit 004d40ee93 I have made it so that C# CodeQL queries which use sinks defined using data extensions (also known as "models-as-data"), which are accessed using `sinkNode(Node node, string kind)`, also use barriers defined using models-as-data, which are accessed using `barrierNode(Node node, string kind)`, with the same `kind` string. Please do the same for C++. If there are any complicated cases then list them at the end for me to do manually.
 2026-01-21 14:45:05 +00:00
Mathias Vorreiter Pedersen
e1089c8d89 Merge branch 'main' into ir-support-for-assertions 2026-01-21 13:56:30 +00:00
Mathias Vorreiter Pedersen
11566ee256 C++: Accept test changes. 2026-01-21 13:50:28 +00:00
Mathias Vorreiter Pedersen
e4ec79255b C++: Fix bugs in variable resolution for assertions following review comments. 2026-01-21 13:50:27 +00:00
Mathias Vorreiter Pedersen
c30dffc7b9 C++: Add more tests. 2026-01-21 13:50:13 +00:00
Geoffrey White
1d461ff5ad Rust: Test unpacking the Wrapping number. 2026-01-21 12:49:59 +00:00
Mathias Vorreiter Pedersen
6ae1ea73f7 Merge pull request #21185 from MathiasVP/mad-cpp-guards 
C++: Support models-as-data barriers and barrier guards
 2026-01-21 12:13:49 +00:00
Paolo Tranquilli
0b9691aca2 Merge pull request #21047 from github/redsun82/codegen-readme 
codegen: mention Rust in the README
 2026-01-21 02:51:07 -08:00
Tom Hvitved
9a9e9ac23c Merge pull request #21168 from hvitved/rust/type-inference-remove-blanket-constraint-restriction 
Rust: Remove restriction that blanket(-like) impls must have a constraint
 2026-01-21 11:05:17 +01:00
Taus
5414bd2716 Merge pull request #21134 from yoff/python/support-ListElement-in-MaD 
Python support `ListElement` in MaD
 2026-01-20 23:38:02 +01:00
Mathias Vorreiter Pedersen
048afc2c88 C++: Add assertion inside catch block. This does not yet work because the 'LocalScopeVariable' does not have a result for 'getFunction'. 2026-01-20 21:31:52 +00:00
Tom Hvitved
f76d85c9c6 Address review comments 2026-01-20 21:06:20 +01:00
yoff
fa926456ef python: add changenote 2026-01-20 18:16:03 +01:00
Jon Janego
1c38fb6ad6 Merge pull request #21196 from github/changedocs-2.23.9 
Changedocs 2.23.9
 2026-01-20 10:43:21 -06:00
Jon Janego
b3b30a15b8 Changedocs for 2.23.9 2026-01-20 10:27:54 -06:00
Jon Janego
4ca508d420 Changedocs for 2.23.9 2026-01-20 10:23:36 -06:00
Jeroen Ketema
fbcb65a5d9 Merge pull request #21195 from jketema/jketema/embed 
C++: Support C23/C++26 `#embed` preprocessor directives
 2026-01-20 16:27:44 +01:00